PT-2016-6836 · Qemu+3 · Qemu+3

Li Qiang · Published 2016-07-27 · Updated 2024-06-15 · CVE-2016-6351

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified)

Description The issue allows local guest OS administrators to cause a denial of service or execute arbitrary code on the QEMU host. This is achieved through vectors involving DMA read into ESP command buffer, specifically via the esp do dma function in hw/scsi/esp.c, when built with ESP/NCR53C9x controller emulation support. The exploitation can result in an out-of-bounds write and QEMU process crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

ALT-PU-2017-1043

CVE-2016-6351

DLA-1599-1

DLA-573-1

DLA-574-1

OPENSUSE-SU-2016_2494-1

OPENSUSE-SU-2016_2497-1

OPENSUSE-SU-2024:10196-1

OPENSUSE-SU-2024:10233-1

SUSE-SU-2016:2093-1

SUSE-SU-2016:2100-1

SUSE-SU-2016:2533-1

SUSE-SU-2016:2725-1

SUSE-SU-2016:3044-1

SUSE-SU-2016_3044-1

USN-3047-1

USN-3047-2

Affected Products

Alt Linux

Qemu

Suse

Ubuntu

References · 495

• https://ubuntu.com/security/CVE-2016-5338 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4453 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17963 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8577 · Security Note
• https://bdu.fstec.ru/vul/2017-01607 · Security Note
• https://ubuntu.com/security/CVE-2016-5337 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-1599-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4037 · Security Note
• https://bdu.fstec.ru/vul/2017-00071 · Security Note
• https://bdu.fstec.ru/vul/2017-00069 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7155 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4454 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:2093-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7994 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5106 · Security Note